Vulnerability Assessment: Tools, Scanning & VAPT Guide

What Is Vulnerability Assessment?

Vulnerability assessment is the process of finding, reviewing and prioritizing potential security weaknesses in systems, networks and applications.

For example, a scanner may report outdated server software, missing security headers or an insecure configuration.

How Vulnerability Assessment Works

Types of Vulnerability Assessment

Vulnerability Assessment vs Penetration Testing

Both activities can include manual investigation. The difference is mainly their objectives and approved depth of testing.

Understanding CVE, CWE and CVSS

These terms help security professionals describe and prioritize security weaknesses.

CVSS Severity Ranges

These ranges describe CVSS qualitative severity. Actual remediation priority also depends on exposure, exploitability and business impact.

Vulnerability Checks with Nmap NSE

Nmap includes NSE scripts that can identify security-related configuration issues and potential vulnerabilities.

Step 1 — Install Nmap

sudo apt update
sudo apt install nmap

Step 2 — Check Available NSE Scripts

nmap --script-help ssl-cert

Step 3 — Inspect a TLS Certificate

nmap -p 443 --script ssl-cert 192.0.2.10

443/tcp open https
| ssl-cert:
|   Subject: commonName=example.com
|   Issuer: commonName=Example CA
|_  Validity: example dates

Step 4 — Check HTTP Security Headers

nmap -p 80,443 --script http-security-headers 192.0.2.10

Nmap also includes a vuln script category, but some scripts perform intrusive checks. Review individual scripts and their effects before use.

Web Server Vulnerability Scanning with Nikto

Nikto is a web server scanner that checks for known files, outdated software indicators and potentially insecure configurations.

Step 1 — Install Nikto

sudo apt update
sudo apt install nikto

Step 2 — Basic Scan

nikto -h http://127.0.0.1:8080

This example assumes you have a local web application running on port 8080.

+ Target Host: 127.0.0.1
+ Target Port: 8080
+ Server: ExampleServer
+ Missing X-Content-Type-Options header
+ Review server configuration

Step 3 — Save Results

nikto -h http://127.0.0.1:8080 -o nikto-report.txt

Vulnerability Scanning with Nuclei

Nuclei is a template-based scanner used to identify known security issues and configuration weaknesses.

Step 1 — Install Nuclei

On Kali Linux, install the packaged version if available:

sudo apt update
sudo apt install nuclei

Alternatively, see the official GitHub repository for current installation methods.

Step 2 — Verify Installation

nuclei -version

Step 3 — Update Templates

nuclei -update-templates

Step 4 — Run Selected Low-Impact Checks

nuclei -u http://127.0.0.1:8080 -tags tech -rl 2

The tech tag is mainly useful for technology detection. It is not a complete vulnerability assessment.

Step 5 — Save Results

nuclei -u http://127.0.0.1:8080 -tags tech -rl 2 -o nuclei-results.txt

[technology-detection] [http] [info]
http://127.0.0.1:8080

Web Vulnerability Assessment with Burp Suite

Burp Suite is a web security testing platform. It helps inspect HTTP requests, responses and application behavior.

Step 1 — Install Burp Suite

Download Burp Suite from the official PortSwigger website. Kali Linux may also include Burp Suite.

Step 2 — Open Your Authorized Lab

Start Burp Suite, open its built-in browser and navigate to a lab application.

Step 3 — Inspect HTTP Traffic

Use Proxy → HTTP history to review requests and responses.

GET /account HTTP/1.1
Host: lab.example
Cookie: session=example-value

Step 4 — Use Repeater

Send a selected request to Repeater. Change one authorized test parameter at a time and compare the response.

How to Verify Vulnerability Findings

After receiving a scanner finding, check whether the issue is real and relevant to the target.

Example: Missing Security Header

A scanner reports that a web application does not return the X-Content-Type-Options header.

curl -I http://127.0.0.1:8080

HTTP/1.1 200 OK
Content-Type: text/html
Server: ExampleServer

The header is absent in this example, but the severity depends on the application's content and context.

Verification Checklist

• Confirm the affected asset is in scope.
• Reproduce the observation safely.
• Check whether the finding is accurate.
• Determine whether there is meaningful security impact.
• Record evidence and recommended remediation.

What Is a False Positive?

A false positive happens when a tool reports a possible security issue that is not actually present.

For example, a scanner may identify a software version associated with a CVE, but the vendor may have backported the security fix without changing the displayed version.

How to Write a Vulnerability Assessment Report

A useful report explains the issue, where it was found, why it matters and how to fix it.

Include severity only after reviewing the real-world impact and context.

Beginner Vulnerability Assessment Workflow

This workflow assumes an authorized local web application is running on port 8080.

Step 1 — Identify the Web Service

nmap -sV -p 8080 127.0.0.1

Step 2 — Review HTTP Headers

curl -I http://127.0.0.1:8080

Step 3 — Run a Nikto Assessment

nikto -h http://127.0.0.1:8080 -o nikto-report.txt

Step 4 — Run Nuclei Technology Checks

nuclei -u http://127.0.0.1:8080 -tags tech -rl 2 -o nuclei-results.txt

Step 5 — Review in Burp Suite

Open the lab through Burp's browser. Review the HTTP history and manually inspect relevant requests using Repeater.

Step 6 — Verify and Document

Compare scanner findings with observed responses, remove false positives and write a clear report.

Vulnerability Assessment Tools Cheat Sheet

Key takeaway: Identify potential issues, verify them, understand their impact and document remediation steps. A tool result alone is not proof of a vulnerability.